Will Anderson
24c2b056ab
Replaces `:latest` + `imagePullPolicy: Always` with a content- addressable SHA tag produced by the dharma-el ci-prod workflow. The deployed image is now deterministic and rollback is `git revert` of this file. `PINNED_BY_NEXT_BUILD` is a deliberate placeholder — Argo CD will fail to reconcile (ImagePullBackOff) until a human replaces it with a real short SHA. That failure is the forcing function: prod only gets a new image via a PR that names a real, built tag. This PR is opened as a draft. Do not merge until: 1. dharma-el#1 (feature/ci-prod-image-build) is merged 2. Dharma CI — prod runs on main and produces a SHA-tagged image 3. The placeholder here is replaced with that SHA `imagePullPolicy: Always` is left in place for now — redundant once we're on SHA tags but removing it in the same PR adds risk. Drop it in a follow-up.
infrastructure
Personal infrastructure-as-code for Legion (k3s home server) and supporting tooling.
| Doc | What it covers |
|---|---|
AGENTS.md |
Full reference: machines, secrets, services, domains, namespaces, common operations |
servers/legion/README.md |
What's running on Legion and how deployment works |
servers/legion/RUNBOOK.md |
Disaster recovery — full restore from scratch |
Quick start
cd servers/legion
direnv allow
terraform plan
terraform apply
Push to servers/ to deploy app changes via Argo CD.